me too.. it's more likely to be a token that's cookied and sent over SSL per api request. Same token that would get generated if they auth'ed via password.